The CVE record for CVE-2026-66755, published by Apache as CVE numbering authority on 31 July 2026 (Perth), describes a relative path traversal in the ISA-Tab parser of Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1. It 'allows an attacker who can place files in a directory that the application subsequently parses to read arbitrary files accessible to the Tika process and have their contents emitted into the extracted text output', via a 'Study Assay File Name' value in the ISA-Tab investigation file that traverses outside the dataset directory.

The affected package is org.apache.tika:tika-parser-scientific-module. Apache rates it CVSS 4.0 5.9 (Medium), local attack vector, and recommends upgrading to 3.3.2 or 4.0.0-beta-1. CISA's enrichment in the record lists exploitation as none. Credited finders: BugQore, and independently n0mi1k.

Correction (28 Oct 2026): removed the Ubuntu USN-8717-1 link, its Ubuntu ESM package versions and its 10 September date, because the notice could not be read by Cyberstack; the card is now sourced to the CVE record and re-dated to the record's publication date. (source: CVE record)